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REMARKS 

The Examiner has rejected Claims 18-23 under 35 U.S.C. 1 12, second paragraph, 
as being indefinite. Applicant has clarified such claims to overcome such rejection. 

The Examiner has rejected Claims 1-3, 6, 8, 9-1 1 , 14, 16, 17-19, 22 and 24 under 
35 U.S.C. 103(a) as being unpatentable over Nachenberg (U.S. Patent No. 6,021,510) in 
view of Kim (The Design and Implementation of Tripware: A File System Integrity 
Checker), in view of Polk et aL (A Guide to the Selection of Anti-Virus Tools and 
Techniques), and in further view of Jones (Building an E-Mail Virus Detection System 
for Your Network). Applicant respectfully disagrees with such rejection, especially in 
view of the amendments made hereinabove to each of the independent claims. 

With respect to each of the independent claims, the Examiner has relied on item 
22 in Figure 3 of Nachenberg to make a prior art showing of applicant's claimed 
"malware scanning code operable to malware scan all computer files stored within a 
storage location as addressed by an operating system to identify any computer files stored 
within said storage location that contain malware" (see the same or similar, but not 
necessarily identical language in each of the independent claims). 

Applicant respectfully asserts that item 22, as relied on by the Examiner, simply 
shows "SCAN[NING] FILE 1 First, applicant respectfully asserts that simply scanning 
one file, as shown in Nachenberg, does not meet applicant's specifically claimed 
"malware scanning code operable to malware scan aU computer files stored within a 
storage location" (emphasis added). Second, Nachenberg only teaches that "File 1 is 
associated with a digital computer" (see Col. 3, line 8). However, applicant notes that 
Nachenberg fails to even suggest "scanning. . . all computer files stored within a storage 
location as addressed bv an operating system " (emphasis added). 

In addition, the Examiner has relied on item 21 in Figure 3 of Nachenberg to 
make a prior art showing of applicant's claimed "when subsequently reading a computer 
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filc, determination code operates]. . . to determine whether or not said computer file is 
stored within a clean storage location" (see the same or similar, but not necessarily 
identical language in each of the independent claims-emphasis added). 

Applicant respectfully asserts that item 21, as relied on by the Examiner, simply 
shows setting a flag according to "whether file 1 is being scanned an initial time" (Col. 3, 
lines 46-49). Thus, there is no "subsequently reading a computer file" taught by 
Nachenberg, and especially not in the context claimed by applicant (emphasis added), but 
instead only a determination as to whether an initial scan is being done. 

Still with respect to each of the independent claims, the Examiner has relied on 
item 39 in Figure 3 of Nachenberg to make a prior art showing of applicant's claimed "if 
said computer file is stored within a clean storage location, then permitting reading of 
said computer file without further malware scanning." Applicant respectfully asserts that 
item 39 as relied on by the Examiner simply discloses making a "determination that file 1 
is 'unchanged in a way that could allow for a viral infection'" and informing a user if it is 
unchanged (see Col. 4, lines 48-53). Clearly, simply detennining if a file is unchanged 
does not meet applicant's specifically claimed detennining "if said computer file is stored 
within a clean storage location" (emphasis added). In addition, Nachenberg only 
discloses informing a user if the file is unchanged, but does not disclose "pennitting 
leading of said computer file without further malware scanning " as claimed by applicant 
(emphasis added). 



To establish zprima facie case of obviousness, three basic criteria must be met. 
First, there must be some suggestion or motivation, either m the references themselves or 
in the knowledge generally available to one of ordinary skill in the art, to modify the 
reference or to combine reference teachings. Second, there must be a reasonable 
expectation of success. Finally, the prior art reference (or references when combined) 
must teach or suggest all the claim limitations. The teaching or suggestion to make the 
claimed combination and the reasonable expectation of success must both be found in the 
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prior art and not based on applicant's disclosure. In re Vaeck$M R2d 488, 20 USPQ2d 
1438 (FedCir. 1991). 

Applicant respectfully asserts that at least the third element of the prima facie 
case of obviousness has not been met, since the prior art references, when combined, fail 
to teach or suggest all of the claim limitations, as noted above. Nevertheless, despite 
such paramount deficiencies and in the spirit of expediting the prosecution of the present 
application, applicant has substantially incorporated the subject matter of Claims 3 and 4 
et al. into each of the independent claims. 

With respect to the subject matter of Claim 3 et al„ namely "wherein said 
malware scanning of all computer files stored within a storage location is performed as a 
background task," the Examiner has stated that the trigger for the scan of a clean location 
in Nachenberg is that a file has changed. The Examiner has argued that the file change is 
not necessarily user generated and that the execution of the scanner requires no user 
intervention such that the scan can be considered a background task. Applicant 
respectfully asserts that Nachenberg only discloses scanning a single file, and not "all 
computer files stored within a storage location,*' as claimed by applicant. 

With respect to the subject matter of Claim 4 et al v as rejected under 35 U.S.C 
103(a) as being unpatentable over Nachenberg in view of Cohen (Current Best Practice 
Against Computer Virus), the Examiner has relied on page 262, Col, 2 S paragraph 2 in 
Cohen to make a prior art showing of applicant's claimed technique "wherein said 
malware scanning of all computer files stored within a storage location as a background 
task is performed with more thorough scanning options selected than for on-access 
scanning applied to computer files not stored within clean storage locations and being 
accessed by a user." 

The Examiner has specifically stated that it "is well known in the art that on- 
access scanners are built to be faster than on-demand scanners . . .since a slow on-demand 
scanner would compromise the user's experience." The Examiner has additionally 
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argued that Cohen supports such an idea by disclosing that the monitor scanner 
''dramatically reduces the costs associated with detecting known viruses." 

Applicant respectfully asserts that the Examiner has failed to consider the full 
weight of applicant's claim language. In particular, applicant claims "wherein said 
malware scanning of all computer files stored within a storage location as a background 
task is performed with more thorough scanning n P Hnn« selected than for on-access 
scanning applied to computer files not stored within clean storage locations and being 
accessed by a user" (emphasis added), and not simply that the background task is faster , 
as the Examiner has argued. Furthermore, although Cohen states that the monitor 
scanner "dramatically reduces the costs," Cohen also discloses that "the virus monitor is 
only effective against known viruses, and is thus quite weak" (see page 267, Col. 2, 
paragraph 1). Clearly, Cohen's disclosure does not even suggest applicant's claim 
language that the "background task is performed with more thorough ggannjag getigns " 
since Cohen admits that a faster scanner such as the monitor is weak. 



Again, s^plicant respectfully asserts' that at least the third element of the prin 
facie case of obviousness has not been met, since the prior art references, when 
combined, fail to teach or suggest all of the claim limitations, as noted above. A notice of 
allowance or a proper prior art showing of all of applicant's claim limitations, j 
combination with the remaining claim elements, is respectfully requested. 



m 



Applicant further notes that the prior art is also deficient with respect to the 
dependent claims. Just by way of example, with respect to Claim 6 et al., the Examiner 
has relied on Col. 3, lines 35-36 in Nachenberg to make a prior art showing of applicant's 
claimed technique "wherein said mahvare scanning code uses malware definition data to 
identify malware and, upon updating of said malware definition data to give updated 
malware definition data, said storage location is no longer identified as a clean storage 
area until it has been malware scanned using said updated malware definition data and no 
computer files containing malware are found in said storage location." 
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Applicant respectfully asserts that such excerpt only discloses that "[f]ile 1 is re- 
examined after it has been determined that the contents of file 1 have changed." Thus, 
Nachenberg only teaches re-examining a file when that same file has been determined to 
have changed, and not "upon updating of said malware definition data to give updated 
malware definition data," as claimed by applicant (emphasis added). Furthermore, 
Nachenberg does not even suggest that **upon updating, of said malware definition data to 
give updated malware definition data, said storage location is no longer identified as a 
clean storage area until it has been malware scanned using said updated malware 
definition data and no computer files containing malware are found in said storage 
location," as specifically claimed by applicant (emphasis added). 

With respect to Claim 7 et al., the Examiner has relied on Green and paragraph 1 , 
lines 8-1 1 in Probert to make a prior ait showing of applicant's claimed technique 
"wherein, when said storage area is being malware scanned with said updated malware 
definition data, computer files written to said storage location after said storage location 
was previously identified as a clean storage location are malware scanned before 
computer files that are unaltered since said storage location was previously identified as a 
clean storage location." 

Specifically, the Examiner has stated that it would make sense to scan to 
configure an engine to scan the most vulnerable items first because users often cancel 
scans before they are complete. The Examiner has relied on Green's disclosure of 
viruses that target newer files in arguing that it would make sense to scan such newer 
files first. In making such an argument, the Examiner has failed to consider the full 
weight of applicant's claim language. In particular, applicant claims that "computer files 
written to said storage location after said storage location was previously identified as a 
clean storage location are malware scanned before computer files that are unaltered since 
said storage location was previously identified as a clean storage location*' (emphasis 
added). Clearly, merely scanning newer files, as the Examiner has argued, does not meet 
applicant's specific claim language that "computer files written to said storage location 
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after said storage location w as previously identified as a clean storage 1r.<^™ ^ 
malware scanned before computer files that are unaltered" (emphasis added). 

Since at least the third element of the prima facie case of obviousness has not 
been met, anotice of allowance or a proper prior art showing of all of the claim 
limitations, in the context of the remaining elements, is respectfully requested. 

Still yet, applicant brings to the Examiner's attention the subject matter of new 
Claims 25-27 below, which are added for full consideration: 

"wherein, if said computer file is stored within said clean storage location, 
then said computer file is permitted to be read without further time spent on 
malware-related processing" (see Claim 25); 

"wherein said malware scanning using said updated malware definition 
data is performed as another background task" (see Claim 26); and 

"wherein all of said computer files stored within said storage location 
addressed by said operating system share a common logical storage location as 
viewed by said operating system such that said logical storage location includes 
computer files sharing similar characteristics" (see Claim 27). 

Thus, all of the independent claims are deemed allowable. Moreover, the 
remaining dependent claims are further deemed allowable, in view of their dependence 
on such independent claims. 

In the event a telephone conversation would expedite the prosecution of this 
application, the Examiner may reach the undersigned at (408) 505-5100. The 



PAGE 16/17* RCVD AT 12112/2005 7:34:30 PM [Eastern Standard Time] * SVR:USPTO-EFXRF-6/25 1 DNIS:2738300 * CSID:4089714660 * DURATION (miMS):04-16 



DEC. 12. 2005 4:47PM ZILKA-KOTAB, PC 



NO. 1290 P. 17 



14- 



Comrnissioner is authorized to charge any additional fees or credit any overpayment to 
Deposit Account No. 50-1351 (Order No. NAI1P496/01. 134.01). 



P.O. Box 721 120 

San Jose, CA 95172-1120 

408-505-5100 




KevhrJ/ziUca 
Resktfation No. 41,429 



PAGE 17/17 • RCVD AT 12/1212005 7:34:30 PM [Eastern Standard Time] 1 SVR:USPTO-EFXRF-6/25 « DNIS:2738300 * CSID:4089714660 * DURATION (mm«s):04-16 



